From 53d74768ad26518edee303da13ae573fb846a14e Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Mon, 26 Oct 2026 23:11:38 +0100 Subject: [PATCH] gateway: take the visitor's address from a PROXY header node001 passes TLS through without opening it, so every request from the tunneled hosts arrives from 46.224.26.65. Wordfence locked that address out after 20 failed logins on 2026-10-26, and with it everyone who logs in to scoutingmbg.nl. With a PROXY header from node001, Envoy puts the visitor's address in X-Forwarded-For instead. The header is optional: s2 and ntfy2 point straight at home, and node001's proxy on port 80 sends none either. --- gateway/proxy-protocol.yaml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 gateway/proxy-protocol.yaml diff --git a/gateway/proxy-protocol.yaml b/gateway/proxy-protocol.yaml new file mode 100644 index 0000000..123f7e7 --- /dev/null +++ b/gateway/proxy-protocol.yaml @@ -0,0 +1,23 @@ +# node001 passes TLS for the tunneled hosts through without opening it, so +# without this every request arrives from 46.224.26.65. Wordfence locks that +# address out after 20 failed logins (2026-10-26), and with it everyone who +# logs in to scoutingmbg.nl. node001 puts a PROXY header with the visitor's +# address in front of each connection; Envoy takes the address from there +# and adds it to X-Forwarded-For. +# +# Optional, because s2 and ntfy2 point straight at home and their clients +# send no header, and neither does node001's proxy on port 80. The price: +# whoever connects to the home address directly can send a header of their +# own and claim any address. +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: ClientTrafficPolicy +metadata: + name: proxy-protocol + namespace: envoy-gateway-system +spec: + targetRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: homelab + proxyProtocol: + optional: true